iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Hash API keys at rest when your service only needs to check whether a presented key is valid: store a verifier, not the reusable plaintext credential. A database breach then does not directly reveal the original key. The trade-off is a verification step on requests, but the available Cloudflare documentation gives no numeric API-key hashing latency benchmark. Measure that cost in your actual runtime rather than assuming a universal overhead.
Why store a verifier instead of the API key?
An API key is a bearer credential: whoever obtains it may be able to use it. If your application only needs to authenticate requests, it can store a one-way verifier derived from the key. When a client presents a key, the service derives a verifier from that value and compares it with the stored record.
If the verifier database is copied, it does not directly disclose the original keys. This reduces the damage from one kind of breach, but it does not make the verifier store harmless: attackers may still try guesses, and a compromised application or verification secret can expose access. Restrict access to the verifier store and protect it as sensitive security data.
Which kind of key are you storing?
The right verification work depends partly on how the credential was created. A long, randomly generated API key has a different guessing risk from a human-chosen password or a short lookup secret. Password hashing is deliberately expensive to make large-scale guessing harder; applying that cost to every high-entropy machine-generated key may add work without a proportionate security benefit.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Credential and use | Approach to consider | Important qualification |
|---|---|---|
| High-entropy, randomly generated API key; verify only | A keyed verifier such as HMAC-SHA-256 can be a practical fast design. | This is an engineering recommendation, not a NIST rule specifically for API keys. Keep the HMAC secret separate from the verifier database. |
| Password or short lookup secret | Use a suitable salted password-hashing scheme with an appropriately chosen work factor. | NIST SP 800-63B Revision 4 gives this guidance for password verifiers, not for every API key. NIST’s 2026 conformance criteria specify a 112-bit threshold for the stated lookup-secret case and a minimum 32-bit salt for that salted-hash case; these are scoped criteria, not a universal API-key policy. NIST SP 800-63B Revision 4 and NIST SP 800-63-4 conformance criteria. |
| Credential must later be retrieved in original form | Encrypt it rather than hashing it. | Encryption requires a recoverable key; manage that key separately and protect access to it. |
NIST also describes an optional additional keyed-hash or encryption iteration for password verifiers, with the key stored separately and protected, for example in an HSM or TEE. Applying that pattern to API-key verification is a design choice by analogy, not a direct NIST API-key requirement. For the construction itself, see the NIST SP 800-224 initial public draft record.
When is hashing the wrong choice?
A one-way verifier cannot produce the original API key. If your service must retrieve and transmit that credential later—for example, to call another system on a user’s behalf—hashing cannot satisfy the requirement. Store the credential encrypted, restrict who can decrypt it, and keep encryption keys under separate management from the encrypted records.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What does hashing cost in an edge function?
There is no supported universal latency premium for API-key verification. Cloudflare documents Web Crypto support for SHA-256, HMAC, and PBKDF2, and says its Web Crypto operations are significantly faster than doing cryptographic work purely in JavaScript. That is a relative platform statement, not a measured time for API-key checks or a benchmark that applies to other edge platforms. Cloudflare Workers Web Crypto documentation.
Recommended Free Tools
Cloudflare provides an example of HMAC with SHA-256 in a Worker, but the example does not establish request-level performance. Cloudflare’s request-signing example.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
In a real request, cryptographic computation may be only part of the verification path. A database read, network round trip, key import or setup, and runtime startup can all affect total latency. Benchmark the production-compatible code path and compare it with a no-hash baseline.
A practical measurement plan
- Use the target edge runtime, deployed-compatible code, actual API-key length, chosen algorithm, and real storage path.
- Include key import or setup if it happens per request; separately measure one-time initialization and per-request verification when the runtime allows it.
- Record cryptographic CPU duration, database and network time, and total request time separately.
- Measure warm and cold execution, report sample count plus p50 and p95, and repeat at representative concurrency.
- Compare the no-hash baseline with the verifier check. Use the results for your own deployment rather than extrapolating from another platform or algorithm.
How should edge secrets be managed?
For Cloudflare Workers, the platform advises storing sensitive values such as API keys and authentication tokens as Worker secrets rather than plaintext environment variables. A Worker can access the secret programmatically, so access to the running Worker and its secret bindings remains important. Cloudflare Workers Secrets documentation.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Cloudflare’s Secrets Store documentation describes account-level secrets encrypted and stored across its data centers, lists compatibility with Workers and AI Gateway, and identifies the service as open beta. Product availability and status can change; check the current documentation before relying on it. Cloudflare Secrets Store overview.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
